Governance , IT Risk Management

Kaspersky’s Claire Hatcher Describes a Layered Approach Suparna Goswami (gsuparna) • December 6, 2019    

Claire Hatcher, global head of fraud prevention, Kaspersky<//figcaption>

As companies go through a digital transformation, they should keep security top of mind, says Claire Hatcher of Kaspersky, who describes a layered approach.`.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

In a video interview at Information Security Media Group’s recent Cybersecurity Summit in Mumbai, Hatcher also discusses:

• How to protect personally identifiable information;
• Taking a balanced approach between security and modernization;
• The challenges of digital transformation.

Hatcher is the global head of fraud prevention at Kaspersky. Previously, she was director of sales strategy at RSA .

Governance , IT Risk Management

RSA’s Ganesh Prasad on Understanding Risk Exposure in a Digital Transformation Suparna Goswami (gsuparna) • December 6, 2019    

Ganesh Prasad, pre-sales manager, India, RSA<//figcaption>

A successful digital transformation journey must include a security transformation journey that includes a careful examination of risks, says Ganesh Prasad of RSA.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

In a video interview at Information Security Media Group’s recentCybersecurity Summit in Mumbai, Prasad talks about:

• What kind of security posture is needed for digital transformation;
• Understanding risk exposure under digital transformation;
• Making sure security is part of business decisions.

Prasad is pre-sales manager, India, at RSA. He has more than 20 years of experience in information technology, of which 10 years are in the security domain.

Governance , IT Risk Management , Privacy

Forescout’s Steven Hunter on How to Ensure Successful Deployment Suparna Goswami (gsuparna) • December 6, 2019    

Steven Hunter, senior director, system engineering, APJ, Forescout<//figcaption>

A common misconception about the “zero trust” model is that once it’s deployed, network security is no longer required, says Steven Hunter of Forescout.

See Also: Unlocking IAM – Balancing Frictionless Registration & Data Integrity

In a video interview at Information Security Media Group’s recent Cybersecurity Summit in Mumbai, Hunter addresses:

• Common misconceptions about zero trust;
• Challenges of coupling access with identity;
• How to ensure successful implementation of zero trust.

Hunter is senior director, system engineering, APJ, at Forescout. Previously, he spent more than 16 years at Cisco in various roles in Australia and Singapore.

The use of artificial intelligence, machine learning and robotics has enormous potential, but along with that promise come critical privacy and security challenges, says technology attorney Stephen Wu.

For example, in healthcare, “we’re beginning to see surgical robots … and robots that take supplies from one part of a hospital to another. …You can use AI to help sequence a child’s DNA … and match and identify a condition in very short order,” Wu says in an interview with Information Security Media Group.

But along with those bold technological advances come emerging privacy and security concerns.

“The HIPAA Security Rule doesn’t talk about surgical robots and AI systems,” he notes. Nevertheless, HIPAA’s administrative, physical and technical safeguard requirements still apply, he says.

As a result, organizations must determine, for example, “what kind of security management procedures are touching these devices and systems – and do you have oversight over them?”

Also critical is ensuring that “communications are secure from one point to another,” he points out. “If you have an AI system that’s drawing records from an electronic health record, how is that transmission being secured? How do we know the AI systems drawing [information] from the EHR system has been properly authenticated?”

Fighting Cybercrime

Over the long haul, AI will play an important role in fighting against AI-fueled cyberattacks, Wu adds.

“You have cybercriminals who are beginning to look at AI systems to better attack different networks and different devices. We’re going to need AI systems to defend ourselves in the future against those possible attacks,” he says.

“It’s simply not possible for a human to pay attention to all the different aspects of a network to watch all parts of it and head off attacks as they come in,” he notes. “And there may be attacks that take place within such a small amount of time that it might be hard or impossible for humans to detect them without the assistance of artificial intelligence.”

Wu will serve as a host of an inaugural American Bar Association National Institute of Artificial Intelligence and Robotics conference Jan. 9-10 at the Santa Clara University School of Law, where he and other experts will discuss emerging legal issues.

In the interview (see audio link below photo), Wu also discusses:

• Other promising applications of AI, machine learning and robotics in various industries;
• General Data Protection Regulation and other regulatory compliance considerations;
• Top cybersecurity-related predictions for 2020 involving the use of AI, machine learning and robotics.

In his role as a technology attorney at Silicon Valley Law Group in San Jose, California, Wu focuses on compliance, liability and information governance in emerging areas of technology law. Wu has written or co-written several books on information security and the law. He served as the 2010-2011 chair of the American Bar Association Section of Science & Technology Law. Before joining Silicon Valley Law Group, Wu was a Silicon Valley partner at Cooke Kobrick & Wu LLP.

Finance & Banking , Industry Specific

Know your enemy: How banks can identify and beat the evolving threat of financial crime Simon Viney • December 6, 2019    

As the old saying doesn’t go, keep your enemies close and your customers even closer. Having a complete overview of your clients and their banking habits – a must for both Know Your Customer (KYC) and basic good customer service practice – means you will inevitably have a greater understanding of your adversaries. This is crucial in the fight against cyber-enabled fraud and other financial crime.

Good housekeeping of customer access, payments and so on is always important, of course, but so too is minimising friction for your valued customers. After all, everybody wants good security but nobody wants to experience a disruption to their service.

“This is driven by increasing specialisation and division of labour. Examples of this collaboration include the attacks on July 20, 2016, where cyber attackers attempted to steal $150 million from a bank in South Asia and then minutes later attacked a bank in West Africa for the same amount. Clearly attackers can coordinate and collaborate in complex attacks across different continents.” 

Education plays a large part in this. “Banks have a duty to communicate about fraudster behaviour with their customers,” says Nick Ryder, Professor in Financial Crime at the University of the West of England. “Banks really need to make their consumers more aware of things like sophisticated email scams claiming to be from the UK ‘Inland Revenue’, for example. If people are new to the internet then they’re going to be susceptible.”

It’s about knowing your customers’ habits thoroughly. You know that your over-65 segment, for example, aren’t likely to be paying money to the relevant income tax authorities regularly.

The problem is that as security systems develop, creative criminals will find new ways to disguise their dealings. Prof Ryder suggests banks look closely at seemingly legitimate operations – “things like people testing their online security. This is a growth area for criminals.” Of course, putting a stop to criminals seeking to test your security and fraud controls is not a viable solution, but continually evolving your security and fraud controls to address your enemies current and future tactics is essential. Equally, sharing intelligence within your organisation is critical; often your cyber team will know information that is incredibly valuable to your fraud team, or vice versa.

Another problem, explains Prof Ryder, is that “laws are always going to be reactionary, as are policies, so it’s like fighting a fire with a small garden hose.” Prevention and early-warning systems are key and this, he says, comes down to knowing customer behaviour extremely well, as well as cyber-crime trends. Banks need to know “which countries are deemed to be at risk, which countries have weak levels of compliance.” This is where banks will be involved in de-risking.

Moreover, knowing the appropriate behaviours of your staff is almost as important as knowing your customer. Insider crime is a real threat and being able to quickly identify when staff activities deviate from normal behaviour is critical in the fight against this. Additionally, when banks are reluctant to bring charges against this type of fraud (usually to guard against negative publicity), it can have an adverse effect on the fight against financial crime.

Good practice when it comes to housekeeping, staff management and high-level Know Your Customer (KYC) will mean banks are far more likely to be able to detect when something’s not right and act to stop or limit the damage caused to their customers and their bottom line.

To find out more, get the full report at a href=https://www.content.baesystems.com/banking-know-your-enemy

Applying offensive hacking expertise and a more adversarial mindset to better hone not just network defenses but also public policy is proving effective, says Jeff Moss, founder and creator of the Black Hat conference (see: Cybersecurity Defenders: Channel Your Adversary’s Mindset).

“This idea of the adversarial mindset stems from: People who started in attack and moved to defense were stunned to find how crazy the defense people were,” Moss says. “They were really smart; they just weren’t doing things that really mattered … [because they were] disconnected from reality,” he says, too often because they didn’t have good information about how criminals or government attackers were hacking them.

All that changed, however, with the rise of large-scale digital forensics firms such as Mandiant that not only investigated intrusions, but publicly released details that spelled out “this is how bad guys are really behaving,” he says in an interview with Information Security Media Group. And that has helped drive more organizations to build red teams that can bring a more adversarial mindset to bear on the organization’s own defenses and help blue teams – defenders – put in place better safeguards.

In this interview (see audio link below the image) recorded at Black Hat Europe 2019, Moss also discusses:

• The increased use of red teams to help organizations’ blue teams and engineers to be more effective;
• How private sector incident response findings and research is reshaping the industry;
• Why efforts to ensure bug-squashing during code design and review does not just aim to fix individual bugs, but whole classes of vulnerabilities.

Moss is the founder and creator of the Black Hat and Def Con conferences and a commissioner of the Global Commission on the Stability of Cyberspace.

3rd Party Risk Management , Governance

How Ratings Can Be Leveraged To Improve Security Performance And Vendor Risk Management Information Security Media Group • December 6, 2019    

As the level of cyber-risk faced by organizations of all shapes and sizes grows every year, security ratings services have emerged as important tools to help companies assess the level of risk imposed by their vendors as well as quantify their own security performance.

However, as the market matures and new players enter, companies need to be careful about which ratings service they look to for vital data.

So how can organizations ensure they choose the right security rating service that enables their team to reduce risk and grow the business safely?

View this webinar OnDemand and learn:

• What security ratings are;
• What to look for in a security ratings service;
• How security ratings fit into the larger security technology picture;
• How ratings can be leveraged to improve security performance and vendor risk management;
• How ratings will help your achieve your security goals.